Malicious code in openai-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b14c6aa9b0f0ab8c4eef077cf58971cd053092124a8d91cb2d478f04bc22ad4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10363 Malicious code in openai-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b14c6aa9b0f0ab8c4eef077cf58971cd053092124a8d91cb2d478f04bc22ad4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gpapps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c69ed66c16eae7a851716f0e0dd61bcc036eb2f1faf2de66faadd80ef3701776 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gpapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8adfa222041807cea6aa53e26cca9c0eba0922efbb9afd0d201d90a3ba201165 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vibewise-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15898c2463520d4782a63156f0ed592f5dc543a0f17bcf72c3d32cb3711b2b06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apps-gpt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e4f318d51a7f0497c7ccda97eb2fbb28071e892d784e3204cb12d9a0b77b4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10395 Malicious code in vibewise-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15898c2463520d4782a63156f0ed592f5dc543a0f17bcf72c3d32cb3711b2b06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10303 Malicious code in gpapps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c69ed66c16eae7a851716f0e0dd61bcc036eb2f1faf2de66faadd80ef3701776 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10394 Malicious code in vibewise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ac8cff44b5e6eda49cbb2c32a6333f5ff2d6910165abc081d1fe0d0bcf11118 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10284 Malicious code in apps-gpt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e4f318d51a7f0497c7ccda97eb2fbb28071e892d784e3204cb12d9a0b77b4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10302 Malicious code in gpapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8adfa222041807cea6aa53e26cca9c0eba0922efbb9afd0d201d90a3ba201165 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @jplopezy/connectivity-test-do-not-install is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious code in @jplopezy/connectivity-test-do-not-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94a8451d9e6d0f50b066cc79da664b4ec909dc1fb835c39f938b5a58dd9f8ad5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10220 Malicious code in @jplopezy/connectivity-test-do-not-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94a8451d9e6d0f50b066cc79da664b4ec909dc1fb835c39f938b5a58dd9f8ad5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

ALSA-2026:38491 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling CVE-2026-22979 kernel: rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 kernel: net...

MAL-2026-10186 Malicious code in google-caja-bower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e34339f1be6afb8a41b6dbe2f7d7c480d5a438a67ff119b235d1d98ffa2b2e4a [email protected] declares scripts.preinstall = 'node index.js', so index.js runs automatically on npm install. index.js walks the...

CVE-2026-6803 AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear'

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wpajax and wpajaxnopriv hooks, as the base...

CVE-2026-55405 LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly int...

Malicious code in @amtrav/webservice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1536781ed617d290a8d9a96fa1a1230943a7cc05957b4b56f853caa902da5856 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @genie-auth/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40bdd86a7980138025e445fc77dd743efbd9e7d9e76b25a24779facd15e16dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...